This week in security: Brotli, Barracuda and Outlook exploited
This week in security was dominated by exploited flaws in edge and productivity software: CISA added 11 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, and we covered 9 stories. The biggest were the Brotli decoder flaw, the chained Barracuda email gateway bugs and the exploited Outlook flaw.
Top stories
- Brotli flaw CVE-2026-111497 exploited; Node.js and Cisco fixes: CISA lists the Brotli decoder flaw as exploited, and it reaches Node.js and .NET users through bundled libraries.
- Barracuda ESG auth bypass CVE-2026-116606 exploited, chains with CVE-2026-111560: Two chained Barracuda flaws sit in KEV with a 13 November deadline, so mail gateways are the first thing to check.
- Microsoft Outlook spoofing flaw CVE-2026-124194 added to CISA KEV: An exploited Outlook flaw reaches every desktop that opens mail; federal agencies must act by 24 November.
- Chrome CVE-2026-125350 use-after-free exploited, added to CISA KEV: Browsers are on every endpoint, and Chromium-based browsers need checking as well as Chrome.
- Microsoft Patch Tuesday November 2026: 1,342 CVEs, 2 exploited: The monthly release includes an exploited Outlook flaw and a KEV-listed OpenSSH bypass.
- FreeSWITCH and Aspera Faspex flaws exploited (CVE-2026-116779): Two exploited flaws in voice and file-transfer systems had a 12 November KEV deadline.
- GPUStack auth bypass CVE-2026-102895 added to CISA KEV: An older GPUStack release allows unauthenticated admin access, which matters for exposed AI infrastructure.
- SonicWall SonicOS SSLVPN MFA bypass CVE-2026-19868 exploited: VPN gateways with SAML MFA enforcement gaps need the vendor mitigations by 20 November.
- Phishing triage: a step-by-step playbook for reported emails: A practical playbook for small teams handling reported emails.
Newly exploited vulnerabilities
These entries were added to the CISA KEV catalog this week. “Due” is the date by which US federal agencies must remediate.
| CVE | Product | Name | Due |
|---|---|---|---|
| CVE-2026-124194 | Microsoft Office | Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability | 2026-11-24 |
| CVE-2026-111793 | Openwave Messaging Limited Webtop Media Transcoder | Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability | 2026-11-24 |
| CVE-2026-20320 | Cisco BroadWorks | Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability | 2026-11-24 |
| CVE-2026-111560 | Barracuda Networks Multiple Products | Barracuda Networks Multiple Products OS Command Injection Vulnerability | 2026-11-13 |
| CVE-2026-116606 | Barracuda Networks Barracuda Email Security Gateway (ESG) | Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-11-13 |
| CVE-2026-125350 | Google Chromium | Google Chromium Use-After-Free Vulnerability | 2026-11-24 |
| CVE-2026-102895 | GPUStack GPUStack | GPUStack Improper Authentication Vulnerability | 2026-11-12 |
| CVE-2026-123158 | OpenBSD OpenSSH | OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability | 2026-11-12 |
| CVE-2026-116779 | SignalWire FreeSwitch | SignalWire FreeSwitch Code Injection Vulnerability | 2026-11-12 |
| CVE-2026-123218 | IBM Aspera Faspex | IBM Aspera Faspex Incorrect Authorization Vulnerability | 2026-11-12 |
| CVE-2026-19868 | SonicWall SonicOS SSLVPN | SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability | 2026-11-20 |
What to prioritise next week
- Anything with a due date that has already passed or falls today (12 and 13 November: Barracuda, GPUStack, OpenSSH, FreeSWITCH, Aspera Faspex). Treat KEV listing as a reason to patch within hours, not weeks, for internet-facing systems.
- Internet-facing edge devices: Barracuda gateways, SonicWall SSLVPN and GPUStack. Review admin accounts and configuration changes for signs of earlier compromise, since exploitation may predate the patch.
- Endpoints: roll out the Outlook fix from Patch Tuesday and update Chrome and other Chromium-based browsers. Confirm deployment with inventory data rather than assuming auto-update worked.
- Developer and server runtimes: check Node.js, .NET and any software that bundles Brotli.
- Entries due 24 November (Outlook, Chromium, Cisco BroadWorks, Openwave) are next in line; schedule them now. This is our prioritisation advice, not a statement from CISA.
Counts and dates above come from the KEV entries and our published posts; follow each linked post for affected versions and fixes.
Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.
Sources
- CISA Known Exploited Vulnerabilities Catalog
- Brotli flaw CVE-2026-111497 exploited; Node.js and Cisco fixes
- Barracuda ESG auth bypass CVE-2026-116606 exploited, chains with CVE-2026-111560
- Microsoft Outlook spoofing flaw CVE-2026-124194 added to CISA KEV
Spotted an error or outdated detail? Email contact@cyberstrikenews.com with the article link. We correct and note every change. Read our Editorial Policy.
